Expected behaviour of an unconditional watch

Elastic Stack Elasticsearch
1

Hi,

Similar to the example in the docs, I have created a watch to email a status report once every 24 hours, at 8am. When the watch fires at the specified time, its stays in the 'firing' state and never returns to the 'OK' state. As it's an unconditional watch, I expect it to fire once every 24 hours, but I dodn't expect it to report it in a state of firing all the time, but only when it is actually sending the email defined in the actions, and return to OK once finished.
Also if someone were to come along and ACK the watch, as the state never changes, it will always remain ACKed and therefore never fire again as I believe the logic needs to see a state change in the conditional in order to reset the ACK. Once the watch has been ACKed, I don't see any way on un-ACKing it and therefore never fires again.

Has anyone else done this and how do you get around the stcuk firing and potential stuck ACKed states, when using an 'ALWAYS' condition?

TIA

2

Hey,

just to be sure we are talking about the same thing, before I say something wrong. Can you show, what status in the JSON you are referring to? Or are you referring to the watcher UI in kibana?

having an always true condition does mean, that an acked watch cannot be unacked, until it is deleted and stored again.

--Alex

3

It was the status on the Watcher UI in Kibana I was referring to. I will just have to make sure no one ACKs the watch.

Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.